Presbyterian Healthcare Services Data Breach Impacts 183,000 Patients
New Mexico-based Presbyterian Healthcare Services is notifying approximately 183,000 patients and health plan members that some of their protected health information (PHI) has been exposed in a recent security breach.
On or around May 6, 2019, several Presbyterian Healthcare Services employees received phishing emails. Certain employees responded to the emails and inadvertently disclosed their credentials to the attackers. Those credentials were used to gain access to accounts containing sensitive information such as names, dates of birth, and Social Security numbers.
Presbyterian Healthcare Services became aware of the breach on June 9 and immediately secured the affected accounts. The breach investigation uncovered no evidence to suggest any personal information was accessed or stolen by the attacker and no reports been received to suggest any PHI has been misused.
Affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months and have been advised to monitor their accounts and explanation of benefits statements carefully for any sign of fraudulent activity.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Presbyterian Healthcare Services is taking steps to improve email security to prevent any further breaches of this nature in the future.
3,812 Patients Affected by Three Rivers Community Health Group Phishing Attack
Perry County Medical Center, Inc. d/b/a Three Rivers Community Health Group, has discovered an unauthorized individual has gained access to the email account of one of its employees and may have viewed patient information.
The account breach was discovered on May 28, 2019. A forensic investigation was conducted by external computer experts who determined that patient information such as names, dates of birth, dates of service, physicians’ names, prescription information, health insurance group, and ID numbers may have been accessed. No financial information or Social Security numbers were breached.
No evidence of unauthorized data access or data theft were uncovered and the community health group is unaware of any instances of identity theft or misuse of PHI. As a precaution, all affected individuals have been offered complimentary credit monitoring and identity theft protection services.
The attack has prompted a review of privacy and security controls and additional protections will be implemented as appropriate to enhance email security.
